1

Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs.

If this would be the case, are they self signed? Are the play store apps signed by Google in any way?

Is it possible using this signature detection to detect if an app is from the Play Store?

  • It sounds like you're asking us to teach you all about Android code signing. That is too broad a question. What problem are you trying to solve? – Neil Smithline Jun 8 '16 at 3:45
  • @NeilSmithline Mainly verification that the app is from Play Store or Google and not backdoored or sideloaded spyware or malware. – user76223 Jun 8 '16 at 4:57
4

All android apps must be signed by developers using self-signed certificates or by third-parties, such as an OEM, mobile operator, or alternate market. When apps are updated, the updated versions must be signed by the same developer. Additionally, applications can share permissions if they are signed by the same developer.

Apps on Google Play are also signed by Google Play. By default, Android blocks the installation of apps that are not signed by Google Play, unless the user has specifically enabled the "Unknown Sources" option under Security Settings.


References:

https://source.android.com/security/overview/app-security.html#application-signing https://developer.android.com/distribute/tools/open-distribution.html https://developer.android.com/studio/publish/app-signing.html

  • If you possible can you add the code signature verification method as asked in the question. Also what type of signature is used? GPG? – user76223 Jun 9 '16 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy